Field of the Invention
This invention relates to the field of data processing systems. More particularly, this invention relates to data processing systems in which it is desired to scan a plurality of computer files to identify one or more computer files having one or more predetermined characteristics indicative of a computer file having at least some specified content.
Description of the Prior Art
It is known to provide anti-virus computer programs and E-mail and data filtering programs. Anti-virus and content filtering computer programs may operate in an on-access mode or an on-demand mode. In an on-access mode, when an access request is made to a computer file, that computer file is subject to scanning for computer viruses, worms, Trojans or other undesired content using a library of data defining such content to be detected. In an on-demand mode, a user initiated or scheduled request may be made to scan a portion of or a complete volume of data with all the computer files contained in that volume being subject to scanning to some degree, even if this is merely to determine they are of a type that does not need scanning.
In a similar manner, network transport filtering programs may operate to scan incoming or outgoing E-mail messages and other data streams for undesired content. This may take place as the data is flowing in and out, or alternatively may take place in a scheduled on-demand sense whereby a complete volume of data is scanned as a scheduled or user triggered event.
A problem in both the above systems is that the amount of data that needs scanning is rapidly increasing. Furthermore, the number of computer viruses and other undesired forms of content is also rapidly increasing. These factors combine to significantly increase the processing load to carry out such tasks. The situation can arise when the amount of slack time, such as overnight periods or weekend periods, is insufficient to allow on-demand scans to be run within the period available. This can have the result that such scans need to be terminated early without fully completing thereby potentially significantly compromising the security and usefulness of such systems.